config PRs: remove the hive's config-PR webhook, poll and core merge

An operator's merge on the forge deploys a config PR through
swarm-controller's DeployRequest{rev}. The hive-side path that queued a
MergeConfigPr approval and merged the PR as `core` goes:

- the `/webhook/config-pr` receiver, its HMAC secret, the WebhookRegister
  boot node and the org-hook registration; the hive vhost's `/webhook/`
  location
- the 5-minute config-PR poll
- ApprovalKind::MergeConfigPr, its dashboard card, and the deploy DAG it
  drove (DeployWindow, MergeVerify, DeployApply, FinalizeDeploy,
  DeployTail), with verify_commit, the two-phase meta deploy, rollback
  refs, the PR-failure comment and forge/pr_merge.rs
- `fetched_sha`, `sha_short`/`pr_number` on approval events, and
  `sha`/`tag` on HelperEvent::ApprovalResolved: only the merge path set
  them

`config_repo`, `merged_pr_for_commit` and `post_pr_comment` move to
forge/pr_comment.rs for the merged-rev deploy's refusal comment.
Approvals v5 drops stored `merge_config_pr` rows; a test reopens a v4
database holding them.

Closes #4850

hive-c0re/src/workers/auto_update.rs

@@ -453,14 +453,13 @@ fn boot_action(wanted: Option<crate::power::Wanted>, fresh: bool, running: bool)
     }
 }
 
-/// Submit the boot-time forge/matrix/webhook/knowledge/wanted-state sweeps as
-/// DAG nodes — `ForgeSweep`, `MatrixSweep`, `WebhookRegister`,
-/// `KnowledgePull`, `WantedPull`. Unlike
+/// Submit the boot-time forge/matrix/knowledge/wanted-state sweeps as DAG
+/// nodes — `ForgeSweep`, `MatrixSweep`, `KnowledgePull`, `WantedPull`. Unlike
 /// [`submit_boot_tree`] this runs on **every** boot, quiet or not: these
 /// aren't config-drift work, they're startup housekeeping that always needs
 /// to happen, and the point of moving them here is exactly so they show up
 /// as real work on the dashboard instead of an invisible `tokio::spawn` that
-/// only surfaces on failure. Five independent, build-slot- and lease-exempt
+/// only surfaces on failure. Four independent, build-slot- and lease-exempt
 /// roots — no dependency edges between them, matching the existing
 /// `Reconcile`-root pattern in [`boot_nodes`]. `MatrixSweep` and
 /// `KnowledgePull` hold their sweep's own resource, so each queues behind any
@@ -471,7 +470,6 @@ fn submit_startup_sweep_nodes(coord: &Arc<Coordinator>) {
     if let Err(e) = coord.job_queue.insert_job(|b| {
         let _ = b.node(NodeKind::ForgeSweep);
         let _ = crate::job_queue::templates::matrix_sweep(b);
-        let _ = b.node(NodeKind::WebhookRegister);
         let _ = crate::job_queue::templates::knowledge_pull(b);
         let _ = b.node(NodeKind::WantedPull);
         Vec::new()